NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore.
Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them.
Any version before v2.12.6 or v2.11.15
If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
| Score | Percentile |
|---|---|
| 0.03% | 6.86% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 4.9 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-9983-vrx2-fg9c ↗ |
| CVE | CVE-2026-33222 ↗ |
| CWE id | Name |
|---|---|
| CWE-285 | Improper Authorization |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| go | github.com/nats-io/nats-server/v2 | < 2.11.15 | 2.11.15 | — |
| go | github.com/nats-io/nats-server/v2 | >= 2.12.0-RC.1, < 2.12.6 | 2.12.6 | — |
| go | github.com/nats-io/nats-server | > 0 | — | — |